[RHEL/6] scap_org.open-scap_datastream_from_xccdf_ssg-rhel6-xccdf-1.2.xml - Every <xccdf:platform> or <cpe2:fact-ref> MUST match as EQUAL or SUPERSET to a CPE in a CPE dictionary component of this data stream.

[iankko]

The NIST SCAP content validation testsuite requires every <xccdf:platform> element specified in <xccdf:benchmark> element to match as EQUAL or SUPERSET to a CPE in a CPE dictionary component for that particular data stream. The specific error message from validation (https://jlieskov.fedorapeople.org/scap-scapversion-1.2-validation-result.html) is as follows:

15-1    1
(of 1)  ERROR   SCHEMATRON  scap_org.open-scap_datastream_from_xccdf_ssg-rhel6-xccdf-1.2.xml - Every <xccdf:platform> or <cpe2:fact-ref> MUST match as EQUAL or SUPERSET to a CPE in a CPE dictionary component of this data stream.    

xccdf:platform cpe:/o:redhat:enterprise_linux:6::client in ds:data-stream scap_org.open-scap_datastream_from_xccdf_ssg-rhel6-xccdf-1.2.xml

Schematron Context:
/*:data-stream-collection[namespace-uri()='http://scap.nist.gov/schema/scap/source/1.2'][1]/*:data-stream[namespace-uri()='http://scap.nist.gov/schema/scap/source/1.2'][1]     if( function-available('java:isEqualOrSuperset') ) then (every $m in ds:checklists/ds:component-ref satisfies ((every $n in xcf:get-component($m)//xccdf:platform[not(starts-with(@idref,'#'))] satisfies some $o in ds:dictionaries/ds:component-ref satisfies some $p in xcf:get-component($o)//cpe-dict:cpe-item satisfies java:isEqualOrSuperset($n/@idref,$p/@name)) and (every $q in xcf:get-component($m)//cpe-lang:fact-ref satisfies some $r in ds:dictionaries/ds:component-ref satisfies some $s in xcf:get-component($r)//cpe-dict:cpe-item satisfies java:isEqualOrSuperset($q/@name,$s/@name)))) else true()

There's one instance of this error message.